fix(docker): pull the image off a vulnerable @hono/node-server (GHSA-frvp-7c67-39w9)

[askalf]

Closes code-scanning alert #28 (Scorecard Vulnerabilities, high).

Where it came from

The alert opened at 01:14Z, minutes after #91 merged. The dependency is not new — npm i -g was installing the same tree before — but nothing in the repo described it, so nothing could see it. The lockfile #91 added is what made it visible, which is the point of having one.

GHSA-frvp-7c67-39w9 (published 2026-07-21, hours before that merge) is a path traversal in @hono/node-server's serve-static, patched in 2.0.5. It reaches the image transitively:

@modelcontextprotocol/server-everything@2026.7.4  (latest)
  └─ @modelcontextprotocol/sdk@1.29.0             (latest)
       └─ @hono/node-server "^1.19.9"   ← caret range can never reach 2.0.5

Both packages are already at their latest published versions, so there is no upstream bump to wait for. An npm overrides entry is the only way off it today.

Why this is tested, not assumed

Forcing a transitive major the SDK was not written against is the actual risk in this change, so I ran it rather than reasoning about it:

• npm ci --omit=dev in a clean directory with an empty npm cache and GIT_SSH_COMMAND=false → 108 packages, @hono/node-server pinned to 2.0.11
• live MCP handshake against that exact tree → tools/list returns all 13 tools (echo, get-annotated-message, get-env, …)

The full image build, non-root check, and in-container handshake are what docker.yml asserts on this PR.

Honest scope

The image only ever runs the downstream over stdio — it never constructs a Hono HTTP server, so the vulnerable serve-static path was unreachable here either way, and the advisory is Windows-specific besides. This is about a supply-chain tool not shipping a flagged dependency in its own image, not about a live exploit.

Drop the override once the SDK widens its range. Dependabot watches /docker (added in #91) and will offer that bump; the reason is recorded next to the override in docker/package.json.

[sprayberry-reviewer]

Automated review from the Sprayberry Labs fleet code reviewer.

Verdict: No blocking issues — clean, well-documented dependency-override fix. Approving.

What I checked

• docker/package.json: adds an overrides.["@hono/node-server"]: "^2.0.5" to force the transitive dependency (server-everything → @modelcontextprotocol/sdk → @hono/node-server ^1.19.9) past the caret ceiling that otherwise can't reach the patched 2.0.5 (GHSA-frvp-7c67-39w9, path traversal in serve-static). The rationale is recorded inline in a comments key next to the override — good practice, keeps the "why" attached to the code instead of only in the PR body.
• docker/package-lock.json: the lockfile's @hono/node-server entry is bumped from 1.19.14 → 2.0.11 (integrity hash updated accordingly), consistent with the new override. Only that one dependency's entry changed — no unrelated lockfile churn.
• Engine bump: 2.0.11's engines.node requirement moved from >=18.14.1 to >=20. The image's Dockerfile builds from node:26-slim, so that requirement is satisfied and this isn't a live constraint issue.
• CI rollup (gh pr checks 96) is all green: CodeQL, build-and-smoke, the full test matrix (macOS/Ubuntu/Windows × Node 20/22), and "verify pinned skills" all passed.
• The PR body documents that this was tested beyond just editing the lockfile — a clean npm ci --omit=dev install plus a live MCP handshake confirming all 13 tools still list — and is honest about scope (the image only talks stdio, never opens the vulnerable HTTP serve-static path, so this is precautionary supply-chain hygiene rather than closing a reachable exploit here).

What's good

• Override reasoning is co-located with the code change (comments key) rather than only living in the PR description, so it won't get lost.
• Scope is minimal and targeted: only the flagged dependency's version and hash move in the lockfile.
• The author verified the change empirically (clean install + live handshake) rather than just editing pins, and was explicit about the fix being precautionary since the vulnerable path is unreachable from this image's stdio-only usage.

No correctness, security, or coverage concerns in the diff. Approving.